rpm package
opensuse/zstd-jni&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/zstd-jni&distro=openSUSE%20Tumbleweed
Vulnerabilities (2)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-87825 | Hig | 7.7 | < 1.5.7.16-1.1 | 1.5.7.16-1.1 | Sep 9, 2026 | zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream | |
| CVE-2026-87823 | Hig | 8.2 | < 1.5.7.16-1.1 | 1.5.7.16-1.1 | Sep 9, 2026 | zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, |
- affected < 1.5.7.16-1.1fixed 1.5.7.16-1.1
zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream
- affected < 1.5.7.16-1.1fixed 1.5.7.16-1.1
zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory,